Resist not Evil? The Price of Patience in a Hybrid War

Leipzig/Halle Airport © Aagnverglaser / Creative Commons Attribution-ShareAlike 4.0 International License / Wikimedia Commons

A Drone at Leipzig

In August, three drones were detected near Leipzig/Halle Airport, one of them reportedly carrying explosives and found near a Ukrainian cargo aircraft: 1.8 kg of Semtex. The airport serves as a key NATO logistics hub for airlifting arms and equipment to Ukraine. The explosive failed to detonate, which otherwise would have engulfed the airport. Germany attributed the attack to Russia, which called the claims fake and promised retaliation.

What was Europe’s response afterwards? The EU summoned the Russian envoy and is pushing for an expanded sanctions package. In the words of Kaja Kallas, the EU’s High Representative: “…this has all the hallmarks of state-sponsored terrorism. The question is, what do we do about this? We have already summoned the Russian ambassador…and we will discuss what else we can do.” Since then, the EU has agreed on the 22nd sanctions package, the largest one in terms of listings yet. Germany closed the Russian consulate in Bonn and the Russian House in Berlin; Russia, in turn, closed the Goethe Institute.

The Deniability Game

Leipzig is not the first incident. Many cases of Russian responsibility, or at the very least suspicion, have occurred: railway sabotage in Poland, an arson attack on an Estonian defence company, a warehouse fire in Bulgaria, a sabotage attempt on Baltic undersea cables, assassination attempts on defence executives, to name but a few.

For years now, Russia has waged a sub-Article 5-threshold campaign against European states. Many of these attacks exploit the high political threshold for evidence needed to justify a military response. Everybody knew who was behind these incidents. But the elephant in the room remained unaddressed because proving Russian culpability to a satisfactory standard was difficult. The use of proxies, or gangs, and cryptocurrency payments made it hard to draw a tangible line back to Moscow. Deniability was the name of the game.

So, Europe kept taking blow after blow. Russia learned that each blow was a cheap way to test how far Europe would be willing to go to preserve peace.

Attribution Without Consequence

But the unique case of Leipzig disrupted this equilibrium. The otherwise cautious German government has formally attributed the attack to Russia, specifically to GRU Unit 29155. Leipzig/Halle Airport, being a NATO airlift hub and arms-delivery transit point, makes this an attempted attack on an Allied supply line, on Allied soil.

So, now we know who it was. How far are we willing to go?

The current response, although firmer than usual, comes straight from the diplomatic playbook: diplomatic expulsions, summoning of envoys, an expansion of sanctions, and leaves much to be desired. Sanctions are important, but after four years adapting to them, there is little reason to think that adding one more package of sanctions is drastically going to alter Russia’s behaviour.

Built to Be Absorbed

One might point out that the damage suffered from these hybrid attacks has, so far, not been enormously significant. It has caused fear and structural damage and put human lives at risk. But so far it hasn’t crippled any state. But that is the point; these attacks are made to be absorbed.

Arguably, this misinterprets the essence of deterrence. Deterrence is not only about today’s attack. It is about tomorrow’s, and the one that follows that. A threat is credible only if an adversary believes it will be enforced, and that belief is forged through action. Every unanswered provocation weakens that credibility. A state that repeatedly refuses to respond is not keeping its powder dry, but is telling its enemy that it will keep moving the line whenever it asks nicely.

Each incident without a significant response tells Moscow that this type of attack is safe to conduct, and so the next one might be a little larger. This ratchet-logic behind the increasing audacity and frequency of attacks can only be sustained when it is being fed information about what is safe to carry out. It follows that one day the attack will be something too big for us to simply absorb. At that point, Europe will have to face the choice it spent years communicating to Russia it would never make, and by then it will be too late. Particularly the most recent warnings about a likely future attack only sharpen this point.

A Ladder of Responses

What, then, is to be done? I am less certain here than in the diagnosis, partly because every obvious answer carries some version of the risk it means to reduce. Escalation can be seen as a ladder. For instance, the lower rungs could be non-kinetic: seizure rather than freezing Russian state assets. A middle rung could include supplying Ukraine with the weapons it has been asking for. And finally, and most contentiously, the upper rung could be kinetic action against a military-relevant target inside Russia. In March 2025, Seth Jones of CSIS urged NATO to build a “calibrated offensive campaign” of sanctions, cyber operations and pressure on Russia’s shadow fleet. Eighteen months later, it seems more is necessary.

Not everyone agrees on the means. Some European leaders, like Margus Tsahkna, the Estonian Minister of Foreign Affairs, and NATO Chief Mark Rutte, said to avoid the Russian toolkit and “an eye for an eye” responses. Juraj Majcin and Jannik Hartmann of the European Policy Centre likewise argue for deterrence by punishment without adopting Russia’s methods. Thresholds should be signalled discreetly through non-public channels. At any rate, however Europe chooses to respond, it will likely need to do more.

It would be dishonest not to assume that a firm response could provoke the same escalatory measures it sought to prevent, a scenario we are not prepared for. The Kremlin’s decision-making is opaque; we have no way of ascertaining Putin’s intentions or risk aversion when in confrontation, or the Kremlin’s assumptions about European strength. Whilst Moscow’s frame of reference may be one of strength and weakness, where a firm response may be seen as strength and conducive to caution, it may equally be read as escalation and a pretext for war. Yet, any red lines that Russia has drawn thus far “have proved to be bluffs designed to deter Western support for Ukraine…every Russian redline has been broken, and Russia escalates as far as it can against Ukraine within the limits of not deploying nuclear weapons or conducting a full military mobilization.”

Nevertheless, on 5 October, Martin Jäger, the President of the Federal Intelligence Service, said that “Russia is putting us to the test and closely watching how we handle this situation. From the perspective of the Kremlin leadership, any sign of wavering invites them to further increase the pressure on Germany.” It seems deterrence is failing us, and that the burden of proof has shifted towards the defenders of the status quo.

Restraint Without a Threshold

Turning the other cheek is a principle that can make sense for an individual deciding how to respond to harm done to them. Governments do not have the same freedom. When they turn their cheek, it is never their own. Restraint can be a virtue when it is deliberate and serves a purpose. But restraint without a threshold might be a vice.

There should be as little patience for those who would answer every drone with a missile strike as for those whose only answer is a strongly worded letter. It requires a clear and coordinated policy: attributed attacks on European territory should trigger costs that increase with each incident, drawn from a set of measures that European governments should already agree upon and are visibly prepared to use. The first step must come before the next attack, because a deterrent announced only after the fact is difficult to make credible. Admittedly, this would allow Russia to use salami tactics or better hide its next attack. Whatever the faults in the proposed deterrence policy, fixing them is up to policymakers, not op-ed writers. Nonetheless, flawed deterrence policies are not an excuse for no deterrence policy at all.

Every response to Russia carries a risk, and no decision regarding this should be taken lightly. But endless restraint is not risk-free either. The question is whether we are prepared to pay something now, or a great deal more later.